PT-2022-24890 · Gocd · Gocd

Published 2022-10-14 · Updated 2022-10-21 · CVE-2022-39309

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 21.1.0

Description The issue affects GoCD, a continuous delivery server that automates and streamlines the build-test-release cycle for continuous delivery of products. It leaks the symmetric key used to encrypt/decrypt secure variables/secrets in the GoCD configuration to authenticated agents. A malicious or compromised agent may expose this key from memory, potentially allowing an attacker to decrypt secrets intended for other agents or environments if they also obtain access to encrypted configuration values from the GoCD server.

Recommendations For versions prior to 21.1.0, update to GoCD version 21.1.0 to resolve the issue. At the moment, there are no known workarounds for this issue.

Exploit

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

CWE-499

Related Identifiers

CVE-2022-39309

GHSA-F9QG-XCXQ-CGV9

Affected Products

Gocd

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39309.json · Exploit
• https://github.com/gocd/gocd/security/advisories/GHSA-f9qg-xcxq-cgv9 · Patch
• https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39309 · Security Note
• https://gocd.org/releases/#21-1-0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39309 · Vendor Advisory
• https://github.com/gocd/gocd/releases/tag/21.1.0 · Note
• https://t.me/cibsecurity/51507 · Telegram Post